[B! Webåˆ¶ä½œ][è„†å¼±æ€§] kbysbtmupã®ãƒ

kbysbtmup id:kbysbtmup

Webåˆ¶ä½œã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹kbysbtmupã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

è„†å¼±æ€§ä½“é¨“å¦ç¿’ãƒ„ãƒ¼ãƒ« AppGoat | æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ | IPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
è„†å¼±æ€§ä½“é¨“å¦ç¿’ãƒ„ãƒ¼ãƒ« AppGoat è„†å¼±æ€§ä½“é¨“å¦ç¿’ãƒ„ãƒ¼ãƒ« AppGoatã¨ã¯ è„†å¼±æ€§ä½“é¨“å¦ç¿’ãƒ„ãƒ¼ãƒ«ã€ŒAppGoatã€ã¯ã€è„†å¼±æ€§ã®æ¦‚è¦ã‚„å¯¾ç–æ–¹æ³•ç‰ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹åŸºç¤Žçš„ãªçŸ¥è˜ã‚’å®Ÿç¿’å½¢å¼ã§ä½“ç³»çš„ã«å¦ã¹ã‚‹ãƒ„ãƒ¼ãƒ«ã§ã™ã€‚åˆ©ç”¨è€…ã¯ã€å¦ç¿’ãƒ†ãƒ¼ãƒžæ¯Žã«ç”¨æ„ã•ã‚ŒãŸæ¼”ç¿’å•é¡Œã«å¯¾ã—ã¦ã€åŸ‹ã‚è¾¼ã¾ã‚ŒãŸè„†å¼±æ€§ã®ç™ºè¦‹ã€ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ä¸Šã®å•é¡Œç‚¹ã®æŠŠæ¡ã€å¯¾ç–æ‰‹æ³•ã®å¦ç¿’ã‚’å¯¾è©±çš„ã«å®Ÿæ–½ã§ãã¾ã™ã€‚ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§å¯¾ç–ã«å¿…è¦ãªã‚¹ã‚ãƒ«ã‚’ç¿’å¾—ã—ãŸã„é–‹ç™ºè€…ã‚„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ç®¡ç†è€…ã«ãŠã™ã™ã‚ã§ã™ã€‚
kbysbtmup 2011/01/28
Windowsã ã‘ã‹â€¦â€¦â€¦â€¦â€¦â€¦ã€‚

IPA

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã‚µãƒ¼ãƒãƒ¼

è„†å¼±æ€§

ãƒ„ãƒ¼ãƒ«

ã‚¢ãƒ—ãƒª

Webåˆ¶ä½œ

ã“ã‚Œã¯ä¾¿åˆ©
ãƒªãƒ³ã‚¯
æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼šæƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼šè„†å¼±æ€§å¯¾ç–ï¼šå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹
ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€ã¯ã€IPAãŒå±Šå‡º(*1)ã‚’å—ã‘ãŸè„†å¼±æ€§é–¢é€£æƒ…å ±ã‚’åŸºã«ã€å±Šå‡ºä»¶æ•°ã®å¤šã‹ã£ãŸè„†å¼±æ€§ã‚„æ”»æ’ƒã«ã‚ˆã‚‹å½±éŸ¿åº¦ãŒå¤§ãã„è„†å¼±æ€§ã‚’å–ã‚Šä¸Šã’ã€ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆé–‹ç™ºè€…ã‚„é‹å–¶è€…ãŒé©åˆ‡ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’è€ƒæ…®ã—ãŸã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã‚’ä½œæˆã™ã‚‹ãŸã‚ã®è³‡æ–™ã§ã™ã€‚ ã€Œå®‰å…¨ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ä½œã‚Šæ–¹ã€æ”¹è¨‚ç¬¬7ç‰ˆã®å†…å®¹ ç¬¬1ç« ã§ã¯ã€ã€Œã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®Ÿè£…ã€ã¨ã—ã¦ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã€OSã‚³ãƒžãƒ³ãƒ‰ãƒ»ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚„ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ç‰11ç¨®é¡žã®è„†å¼±æ€§ã‚’å–ã‚Šä¸Šã’ã€ãã‚Œãžã‚Œã®è„†å¼±æ€§ã§ç™ºç”Ÿã—ã†ã‚‹è„…å¨ã‚„ç‰¹ã«æ³¨æ„ãŒå¿…è¦ãªã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®ç‰¹å¾´ç‰ã‚’è§£èª¬ã—ã€è„†å¼±æ€§ã®åŽŸå› ãã®ã‚‚ã®ã‚’ãªãã™æ ¹æœ¬çš„ãªè§£æ±ºç–ã€æ”»æ’ƒã«ã‚ˆã‚‹å½±éŸ¿ã®ä½Žæ¸›ã‚’æœŸå¾…ã§ãã‚‹å¯¾ç–ã‚’ç¤ºã—ã¦ã„ã¾ã™ã€‚ ç¬¬2ç« ã§ã¯ã€ã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã®å®‰å…¨æ€§å‘ä¸Šã®ãŸã‚ã®å–ã‚Šçµ„ã¿ã€ã¨ã—ã¦ã€ã‚¦ã‚§ãƒ–ã‚µãƒ¼ãƒã®é‹ç”¨ã«é–¢ã™ã‚‹å¯¾ç–ã‚„ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆã«ãŠã‘ã‚‹ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å–æ‰±ã„ã«é–¢ã™
kbysbtmup 2010/03/29
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

è„†å¼±æ€§

IPA

ã‚ã¨ã§èªã‚€

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

Webã‚µãƒ¼ãƒ“ã‚¹

Webåˆ¶ä½œ

ã“ã‚Œã¯ä¾¿åˆ©
ãƒªãƒ³ã‚¯
ï¼ ITï¼šã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°å¯¾ç–ã®åŸºæœ¬
æœ€è¿‘Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«å˜åœ¨ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒæ³¨ç›®ã‚’æµ´ã³ã¦ã„ã‚‹ã€‚ãã®ä¸ã§ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã€ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ãŒæœ‰åã§ã‚ã‚‹ãŒã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã«ã¤ã„ã¦æ£ç¢ºã«ç†è§£ã—ã¦ã„ã‚‹äººãŒä¾ç„¶ã¨ã—ã¦å°‘ãªã„ã¨æ„Ÿã˜ã‚‹ã€‚ æœ¬ç¨¿ã§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ã¨ã¯ã©ã®ã‚ˆã†ãªè„†å¼±æ€§ã§ã‚ã‚‹ã®ã‹ã€ã“ã®è„†å¼±æ€§ã‚’æŒã£ãŸã‚µã‚¤ãƒˆãŒæ”»æ’ƒã•ã‚Œã‚‹ã¨ã©ã®ã‚ˆã†ãªè¢«å®³ãŒèµ·ãå¾—ã‚‹ã®ã‹ã€ãªãœãã®ã‚ˆã†ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒä½œã‚Šè¾¼ã¾ã‚Œã¦ã—ã¾ã†ã®ã‹ã€ã©ã®ã‚ˆã†ã«å¯¾ç–ã‚’ã™ã‚Œã°ã‚ˆã„ã®ã‹ã‚’è§£èª¬ã—ã¦ã„ãã€‚ â€»ä»¥ä¸‹æœ¬æ–‡ä¸ã§ã¯ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°è„†å¼±æ€§ã®ã“ã¨ã‚’ã€ŒXSSã€ã¨è¡¨è¨˜ã™ã‚‹ã€‚ã€ŒCross Site Scriptingã€ã®ç•¥ã§ã‚ã‚‹ã‹ã‚‰ã€ŒCSSã€ã¨è¡¨è¨˜ã—ã¦ã„ã‚‹è¨˜äº‹ã‚‚ã‚ã‚‹ãŒã€ã€ŒCascading Style Sheetsã€ã®ç•¥ã‚‚ã€ŒCSSã€ã¨ãªã‚Šç´›ã‚‰ã‚ã—ã„ãŸã‚ã€ã€ŒXSSã€ã¨è¡¨è¨˜ã™ã‚‹å ´åˆãŒå¤šããªã£ã¦ãã¦ã„ã‚‹ã€‚æœ¬ç¨¿ã§
kbysbtmup 2010/02/19
è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

ã‚ã¨ã§èªã‚€

è¨˜äº‹

è§£èª¬

ã¾ã¨ã‚

Webåˆ¶ä½œ

é–‹ç™º
ãƒªãƒ³ã‚¯
ã‚‚ã£ã¨ã‚‚å±ãªã„ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚¨ãƒ©ãƒ¼25ã€+16 | ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. CWE - 2010 CWE/SANS Top 25 Most Dangerous Programming Errorsã«ãŠã„ã¦è„†å¼±æ€§ã®åŽŸå› ã¨ãªã‚‹å±é™ºãªãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚¨ãƒ©ãƒ¼25ãŒç™ºè¡¨ã•ã‚ŒãŸã€‚é–‹ç™ºè€…ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡Œã®åŽŸå› ã¨ãªã‚‹ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã«é–¢ã™ã‚‹æ³¨æ„ã‚’ä¿ƒã—ã€å®Ÿéš›ã«ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒå‹•ä½œã™ã‚‹å‰ã®æ®µéšŽã§å•é¡Œã‚’ç™ºè¦‹ã—å¯¾å‡¦ã§ãã‚‹ã‚ˆã†ã«ã™ã‚‹ã“ã¨ã‚’ç›®æŒ‡ã—ãŸã‚‚ã®ã€‚2009å¹´ã«ç™ºè¡¨ã•ã‚ŒãŸãƒªã‚¹ãƒˆã®æ›´æ–°ç‰ˆã«ã‚ãŸã‚Šã€å†…å®¹ã®å¤šããŒæ›´æ–°ã•ã‚Œã¦ã„ã‚‹ã€‚2009å¹´ç‰ˆã‚’ä½¿ã£ã¦ã„ãŸå ´åˆã«ã¯ã€ä»Šå›žç™ºè¡¨ã•ã‚ŒãŸ2010å¹´ç‰ˆã‚’å†åº¦æ¤œè¨Žã™ã‚‹ä¾¡å€¤ãŒã‚ã‚‹ã€‚
kbysbtmup 2010/02/19
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ã¾ã¨ã‚

è„†å¼±æ€§

ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°

Webåˆ¶ä½œ

Webã‚µãƒ¼ãƒ“ã‚¹

è¨˜äº‹

è§£èª¬

PHP
ãƒªãƒ³ã‚¯
ã‚µã‚¤ãƒˆç´å“å¾Œã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¿®æ£ã¯æœ‰å„Ÿï¼Ÿ ç„¡å„Ÿï¼Ÿ | åˆä»£ç·¨é›†é•·ãƒ–ãƒã‚°â€•å®‰ç”°è‹±ä¹…
ä»Šæ—¥ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã®è©±é¡Œã‚’ã€‚ã¨ã„ã†ã®ã‚‚ã€6æœˆã«IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼‰ãŒå…¬é–‹ã—ãŸã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆæ§‹ç¯‰äº‹æ¥è€…ã®ãŸã‚ã®è„†å¼±æ€§å¯¾å¿œã‚¬ã‚¤ãƒ‰ã€ã¨ã„ã†è³‡æ–™ãŒéžå¸¸ã«ã‚ã‹ã‚Šã‚„ã™ã‹ã£ãŸã‹ã‚‰ã§ã™ã€‚ IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼‰ãŒ2009å¹´6æœˆ8æ—¥ã«ã€ã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆæ§‹ç¯‰äº‹æ¥è€…ã®ãŸã‚ã®è„†å¼±æ€§å¯¾å¿œã‚¬ã‚¤ãƒ‰ã€ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ æ˜¨å¹´ã¯ã€Œã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆé‹å–¶è€…ã®ãŸã‚ã®è„†å¼±æ€§å¯¾å¿œã‚¬ã‚¤ãƒ‰ã€ã§ã—ãŸã‹ã‚‰ã€ã“ã‚Œã§ç™ºæ³¨å´å‘ã‘ã¨å—æ³¨å´å‘ã‘ã®ã€Webã‚µã‚¤ãƒˆã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«é–¢ã™ã‚‹IPAã®ã‚¬ã‚¤ãƒ‰ãŒæƒã£ãŸã“ã¨ã«ãªã‚Šã¾ã™ã€‚ ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆæ§‹ç¯‰äº‹æ¥è€…ã®ãŸã‚ã®è„†å¼±æ€§å¯¾å¿œã‚¬ã‚¤ãƒ‰ â†’ http://www.ipa.go.jp/security/fy20/reports/vuln_handling/ ï¼ˆè§£èª¬ï¼‰ â†’ http://www.ipa.go.jp/security/ciadr/vuln_sier_guide.pdf ï¼ˆæœ¬æ–‡PDF
kbysbtmup 2009/07/07
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

CMS

Webåˆ¶ä½œ

è³‡æ–™

è§£èª¬

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
1